electron-userland/electron-builder electron-updater@7.0.0-alpha.11

on GitHub

Minor Changes

• Feat(s3)!: explicit AWS credential sources for S3 publishing via the new awsCredentials option (restores shared config / IAM Identity Center profiles, #10054) #10257 46be1f4 — builder-util-runtime

  • awsCredentials.source is required to publish (no default, no implicit credentials).
  • awsCredentials.source: "env" reads only AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN, or the variable names given in awsCredentials.env.
  • awsCredentials.source: "profile" with profile (plus optional credentialsFile / configFile) reads a named profile from the shared config and credentials files: static keys, IAM Identity Center (SSO), credential_process and assume-role. The AWS SDK providers are loaded lazily, only for non-static profiles, and are given explicit paths. Assume-role hops use an explicitly configured STS client (named profile's region, no configured endpoint URLs). credential_source and web identity (web_identity_token_file) are rejected anywhere in the chain, before the SDK is loaded.
  • awsCredentials.source: "sso-role-chain" with profile resolves an assume-role profile whose source_profile chain (up to 5 hops, no cycles) starts at an IAM Identity Center (SSO) profile: the SSO profile is resolved from the configured files, then STS AssumeRole is called per hop with explicit region, endpoint and credentials (never AWS_REGION, AWS_PROFILE or AWS_ENDPOINT_URL*). credential_source, mfa_serial, web identity and credential_process are rejected in the chain. source: "profile" keeps rejecting SSO-sourced role chains and points to this source.
  • Resolved credentials are reused for every file of a publish instead of being resolved again per upload.

  BREAKING CHANGE: S3 publishing fails with an InvalidConfigurationError unless awsCredentials.source is set (add { "source": "env" } to keep using AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY). AWS_PROFILE, AWS_SDK_LOAD_CONFIG, AWS_CONFIG_FILE, AWS_SHARED_CREDENTIALS_FILE and an implicit ~/.aws/credentials are no longer read. Missing credentials now fail with a clear error instead of an unsigned or env-fallback signature. For dotted bucket names without region, the region is looked up only when publishing. awsCredentials is never written to app-update.yml.

Patch Changes

• Fix: enforce the configured API redirect limit without an extra hop #10121 8b71ed8 — builder-util-runtime
• Refactor(updater): split GitHubProvider.getLatestVersion into helpers (internal refactor, no behavior change) #10290 4705c20
• Fix: close embedded blockmap files exactly once on parse failures #10120 3bbc563
• Fix(nsis): don't plan a differential download against a cached block map of another release. The cached block map is replaced when a download finishes, but the cached installer only when the update is installed, so a release found before the previous one was installed was planned against the wrong base: every differential byte was downloaded, the sha512 check failed, and the full installer was downloaded too. A cached block map that does not end at the cached installer's size is now ignored and the installed version's block map is fetched from the server. #10337 9ebb992
• Fix(updater): treat channel "latest" as stable-only when allowPrerelease is enabled #10360 a3c9240
• Fix(updater): download differentially when the update manifest has a hex-encoded sha512, never let a throwing logger stop a differential download or its fallback to a full download, time out stalled requests made with Electron's net module, and close the partially written file when a download's response fails or is aborted mid-body #10366 538aef4 — electron-updater, builder-util-runtime
• Refactor(win): export the Windows Authenticode helpers electron-updater verifies update signatures with (preparePowerShellExec, escapePowerShellSingleQuotes, parseAuthenticodeSignatureOutput, matchPublisherName), moved unchanged from electron-updater so electron-builder can check signed installers with the same code #10378 60e3708 — builder-util-runtime
• Refactor(win): verify update signatures with the Authenticode helpers moved unchanged to builder-util-runtime (no behavior change) #10378 60e3708
• Fix: preserve complete XML text and reject incomplete documents #10125 45d3bc4 — builder-util-runtime
• Fix: report finite transfer rates for immediate downloads #10122 370d18c — builder-util-runtime
• Fix: when a server rejects multi-range requests (GitHub release assets answer 501, Google Cloud Storage 400, S3 the whole file with 200), retry the differential download with one range per request instead of downloading the full update. Every range response must now be a 206 for exactly the requested range: a host that ignores ranges used to stream the whole file once per range before the checksum failed, and now fails on its first request and falls back to a full download. #10343 0fdce73
• Fix: installing an AppImage update no longer deletes the installed app before the new one is in place. Before, the updater deleted the running AppImage and then ran mv through PATH; if mv failed (for example spawnSync mv ENOTCONN when a dead AppImage FUSE mount from an earlier launch was on PATH), the user was left with no app to launch. After, the new AppImage is staged next to the old one and atomically renamed over it without running any external command, so a failed install keeps the old AppImage. #10386 8512f4d